HIPAA Breach Notification Rule: Deadlines and Steps

Last updated: 18 October 2026

Quick answer: The HIPAA Breach Notification Rule (45 CFR 164.400-414) requires covered entities to notify affected individuals of a breach of unsecured protected health information without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people also require notice to HHS and, per state, the media. Business associates must notify the covered entity.

When a laptop goes missing or an email with patient records goes to the wrong recipient, compliance teams have to answer three questions quickly: is this a reportable breach, who must we tell, and by when? The HIPAA breach notification rule answers all three, but its details are easy to get wrong under pressure.

This guide walks through the definition of a breach, the four-factor risk assessment, every notification deadline, the business associate chain and the documentation you need to keep. It includes a decision checklist and a notification timeline table.

What is the HIPAA breach notification rule?

It is the part of the HIPAA regulations that tells covered entities and business associates what to do after a breach of unsecured protected health information (PHI). It sits in 45 CFR Part 164, Subpart D, sections 164.400 to 164.414, and is enforced by the HHS Office for Civil Rights (OCR).

The rule applies to:

• Covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct standard electronic transactions.
• Business associates: vendors and contractors that create, receive, maintain or transmit PHI on behalf of a covered entity, and their subcontractors.

It works alongside the Privacy Rule, which defines permitted uses and disclosures, and the Security Rule, which sets safeguards for electronic PHI. A failure under either can lead to a breach that triggers notification. Since February 16, 2026, the compliance date of the 42 CFR Part 2 final rule, the same breach notification requirements also apply to substance use disorder records under Part 2. The Security Rule update proposed in January 2025 had not been finalized at the time of writing and does not change these notification deadlines.

What counts as a breach under HIPAA?

A breach is an impermissible use or disclosure of PHI under the Privacy Rule that compromises its security or privacy. Every impermissible use or disclosure is presumed to be a breach unless you can show a low probability that the PHI has been compromised.

According to HHS breach notification guidance, you rebut that presumption with a documented risk assessment of at least four factors:

1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom it was disclosed.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk to the PHI has been mitigated.

The three exceptions

Three situations are excluded from the definition of breach:

• Unintentional acquisition, access or use by a workforce member or person acting under the entity’s authority, in good faith and within the scope of authority, with no further impermissible use or disclosure.
• Inadvertent disclosure by an authorized person to another authorized person at the same covered entity, business associate or organized health care arrangement.
• A good faith belief that the unauthorized recipient would not reasonably have been able to retain the information.

Why “unsecured” matters

Notification is only required for unsecured PHI. HHS guidance on unsecured PHI recognizes two methods that make PHI secured: encryption consistent with NIST guidance, such as NIST SP 800-111 for data at rest, and destruction consistent with NIST SP 800-88 for electronic media or shredding for paper. The encryption key must not have been compromised along with the data.

In practice: A lost laptop with full-disk encryption that meets HHS guidance, where the key was not stored with the device, is generally not a reportable breach. The same laptop without encryption almost always is. Encryption is the single most effective way to reduce notification events.

What are the HIPAA breach notification deadlines?

The core deadline is without unreasonable delay and no later than 60 calendar days after discovery. Sixty days is an outer limit, not a target, and the clock starts when the breach is discovered, not when the investigation ends.

A breach is treated as discovered on the first day it is known to the entity or, by exercising reasonable diligence, would have been known to any workforce member or agent other than the person who committed it. Reports to HHS are made through the OCR breach portal, which also publishes breaches affecting 500 or more individuals.

Common mistake: Waiting until day 59 because “we have 60 days”. The rule requires notice without unreasonable delay, so a notice sent near the limit can still be late if you had the information you needed weeks earlier.

What must a breach notice to individuals contain?

Under 164.404(c), the notice must be written in plain language and include five elements:

• A brief description of what happened, including the date of the breach and the date of discovery, if known.
• The types of unsecured PHI involved, such as name, Social Security number, date of birth, diagnosis or insurance information.
• Steps individuals should take to protect themselves.
• What the entity is doing to investigate, mitigate harm and prevent recurrence.
• Contact procedures, which must include a toll-free number, email address, website or postal address.

Send notice by first-class mail to the last known address, or by email if the individual has agreed to electronic notice. Where contact details are out of date for 10 or more people, you must give substitute notice: either a conspicuous posting on your website home page for 90 days or notice in major print or broadcast media, plus a toll-free number active for at least 90 days. For fewer than 10 people, alternative written notice, phone or other means may be used.

Managing the investigation, clock and notices across teams is where many organizations slip. You can start your 14-day free trial of Enactia’s incident and data breach management module to log discovery dates, run the risk assessment and track every deadline.

What are business associates required to do?

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Where possible, it must identify each affected individual and provide the information the covered entity needs for its own notices.

Because the covered entity’s clock can start when its business associate discovers a breach, if the business associate is acting as its agent, contract terms matter:

• Set a shorter notification window in the business associate agreement, for example a few days, so you have time to meet your own deadlines.
• Specify the information the business associate must provide and who contacts individuals.
• Require subcontractors to flow the same obligations down.
• Assess business associates’ security before signing and periodically after, through your vendor risk management program.

HIPAA breach checklist: from discovery to closure

Use this sequence as a starting point for your incident response procedure.

1. Record discovery. Log the date and time the incident was first known and by whom.
2. Contain. Stop the disclosure, recover data where possible and preserve evidence.
3. Check scope. Is the data PHI? Is it unsecured? Does an exception apply?
4. Run the four-factor assessment. Document your reasoning and conclusion.
5. Count and locate individuals. Totals decide HHS timing; state counts decide media notice.
6. Check law enforcement. If law enforcement says notice would impede an investigation, delay as permitted by 164.412 and document it. An oral request allows delay of no more than 30 days unless confirmed in writing.
7. Check state law. Many states have their own breach laws with different content rules and shorter deadlines.
8. Notify. Individuals, HHS and media as required, and the covered entity if you are a business associate.
9. Document. Keep notices, risk assessments and decisions. Under 164.414 you carry the burden of proof, and HIPAA documentation is generally retained for six years.
10. Improve. Feed lessons learned into your risk analysis and update policies and training.

How does HIPAA compare with other breach rules?

US health data can fall under HIPAA, the FTC’s rule or state law, and organizations with EU patients may also face GDPR. The timelines differ sharply.

The FTC Health Breach Notification Rule was amended in 2024, with changes taking effect in July 2024, to clarify that it covers many health apps and connected devices. If you also handle consumer data under state privacy laws, our guide to CCPA, CPRA and US state privacy law compliance covers the wider picture.

Key takeaways

• Any impermissible use or disclosure of PHI is presumed a breach unless a documented four-factor assessment shows low probability of compromise.
• Only unsecured PHI triggers notification; encryption and destruction to HHS guidance are the safe harbors.
• Notify individuals without unreasonable delay and within 60 days of discovery; 500+ breaches also require HHS and possibly media notice.
• Business associates must notify covered entities within 60 days, but contracts should set shorter windows.
• You carry the burden of proof, so document every assessment and notice.

Frequently asked questions

How long do you have to report a HIPAA breach?
Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more people, HHS must be notified at the same time. Breaches affecting fewer than 500 people can be logged and reported to HHS within 60 days after the end of the calendar year.

Is every HIPAA violation a reportable breach?
No. Only impermissible uses or disclosures of unsecured PHI that are not covered by an exception, and for which a risk assessment cannot show a low probability of compromise, are reportable. Violations such as a missing policy are compliance failures but not breaches unless PHI was actually used or disclosed impermissibly.

Does encryption mean we never have to notify?
If PHI was encrypted in line with HHS guidance and the key was not compromised, the data is considered secured and notification is not required under HIPAA. If the key was stored with the device or also exposed, the data is treated as unsecured. State laws may still apply, so check them too.

When is media notice required?
Media notice is required when a breach involves more than 500 residents of a single state or jurisdiction. The covered entity must notify prominent media outlets serving that area, without unreasonable delay and within 60 days of discovery, usually through a press release. The count is per state, not the national total.

What happens if a business associate reports late?
The covered entity remains responsible for notifying individuals on time. If the business associate is acting as the covered entity’s agent, its discovery date can start the covered entity’s clock. Late reporting can also breach the business associate agreement and expose the business associate to its own HIPAA enforcement.

Conclusion: prepare before the clock starts

The HIPAA breach notification rule rewards preparation. Encrypt PHI, define discovery and escalation, pre-draft notice templates, tighten business associate agreements and practice the four-factor assessment before you need it. When an incident happens, your team can then focus on facts and deadlines instead of process.

Enactia’s AI-powered GRC platform brings breach workflows, vendor oversight and HIPAA compliance into one place. Contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.